Skip to content

Fix[JsonDecoderUtil]: validate JSON payload length #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
678098 merged 1 commit into from
Oct 27, 2026
Merged

Fix[JsonDecoderUtil]: validate JSON payload length #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion bmq-sdk/src/main/java/com/bloomberg/bmq/impl/infr/codec/JsonDecoderUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ public static <T> T decode(ByteBufferInputStream bbis, Type msgType) throws IOEx

public static String getJsonFromInputStream(ByteBufferInputStream bbis) throws IOException {
final int bytesAvailable = bbis.available();
if (bytesAvailable == 0) {
throw new IOException("No bytes to decode");
}

byte[] bytes = new byte[bytesAvailable];

final int bytesRead = bbis.read(bytes);
Expand All @@ -48,7 +52,7 @@ public static String getJsonFromInputStream(ByteBufferInputStream bbis) throws I
}

final int padding = bytes[bytes.length - 1];
if (padding < 0 || padding > 4) {
if (padding < 0 || padding > 4 || bytesAvailable <= padding) {
throw new IOException("Invalid padding value encountered while decoding " + padding);
}

Expand Down
24 changes: 24 additions & 0 deletions bmq-sdk/src/test/java/com/bloomberg/bmq/impl/infr/codec/JsonDecoderUtilTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.fail;

Expand Down Expand Up @@ -231,6 +232,29 @@ void testDecodeStatus() throws IOException {
assertEquals("Test", status.message());
}

@Test
void testGetJsonFromInvalidInput() {
assertThrows(
IOException.class,
() ->
JsonDecoderUtil.getJsonFromInputStream(
new ByteBufferInputStream(ByteBuffer.allocate(0))));

// Padding value is larger than the input
assertThrows(
IOException.class,
() ->
JsonDecoderUtil.getJsonFromInputStream(
new ByteBufferInputStream(ByteBuffer.wrap(new byte[] {'{', 3}))));

// Input contains only padding
assertThrows(
IOException.class,
() ->
JsonDecoderUtil.getJsonFromInputStream(
new ByteBufferInputStream(ByteBuffer.wrap(new byte[] {2, 2}))));
}

@Test
void testDecodeFromJsonFail() {
JsonDecoderUtil.decodeFromJson("\"test_string\"", String.class);
Expand Down
Loading